Inspect any domain's TLS certificate from your terminal — validity, expiry, issuer, SANs, and revocation in one clean, color-coded summary.
| docs | ||
| scripts | ||
| tests | ||
| .gitignore | ||
| .python-version | ||
| checkcert.py | ||
| CLAUDE.md | ||
| justfile | ||
| pyproject.toml | ||
| README.md | ||
| uv.lock | ||
checkcert
A small CLI that inspects a domain's TLS certificate and prints a clean,
color-coded summary — validity, expiry (with a countdown), issuer, the names it
covers (CN + SANs), and live revocation status (OCSP stapling / OCSP / CRL).
-v adds full identity, X.509 extensions, and fingerprints.
Above: the cert chains fine (✓ Valid) but checkcert catches that it has been revoked via its CRL.
checkcert github.com
checkcert revoked-isrgrootx1.letsencrypt.org
checkcert -v cloudflare.com
A bare hostname is assumed to be HTTPS on port 443; an explicit port is honored.
Requirements
- Python 3.13+
- The
opensslCLI on yourPATH(used for details the Pythonsslmodule doesn't expose). Without it, the core summary still works but some fields show an error.
Install
It's a single self-contained script — symlink it onto your PATH:
ln -s "$PWD/checkcert.py" ~/.local/bin/checkcert
Development
See CLAUDE.md for design notes and conventions. Run the tests with:
just test # or: uv run pytest